crussh 0.1.0

data/lib/crussh/server.rb

@@ -0,0 +1,214 @@
+# frozen_string_literal: true
+
+module Crussh
+  class Server
+    class << self
+      def configure
+        yield config
+      end
+
+      def config
+        @config ||= Config.new
+      end
+
+      def banner(text = nil, &block)
+        return @banner = block if block
+
+        @banner = text
+      end
+
+      def read_banner
+        @banner.is_a?(Proc) ? @banner.call : @banner
+      end
+
+      def authenticate(method, &block)
+        auth_handlers[method] = AuthHandler.new(block)
+      end
+
+      def auth_handlers
+        @auth_handlers ||= {}
+      end
+
+      def accept(*types, only: nil, except: nil, if: nil, unless: nil, &block)
+        rule = RequestRule.accept(
+          only: only,
+          except: except,
+          if: binding.local_variable_get(:if),
+          unless: binding.local_variable_get(:unless),
+          &block
+        )
+
+        types.each { |type| request_rules[type] = rule }
+      end
+
+      def reject(*types)
+        rule = RequestRule.reject
+
+        types.each { |type| request_rules[type] = rule }
+      end
+
+      def request_rules
+        @request_rules ||= {}
+      end
+
+      def handle(type, handler = nil, &block)
+        handlers[type] = handler || block
+      end
+
+      def handlers
+        @handlers ||= {}
+      end
+
+      def inherited(subclass)
+        subclass.instance_variable_set(:@config, config.dup)
+        subclass.instance_variable_set(:@auth_handlers, auth_handlers.dup)
+        subclass.instance_variable_set(:@banner, @banner)
+
+        super
+      end
+
+      def run(**options)
+        new(**options).run
+      end
+    end
+
+    def initialize(**config)
+      @config = self.class.config.dup
+
+      config.each do |key, value|
+        @config.public_send(:"#{key}=", value)
+      end
+
+      @config.validate!
+
+      @gatekeeper = Gatekeeper.new(
+        max_connections: @config.max_connections,
+        max_unauthenticated: @config.max_unauthenticated,
+      )
+    end
+
+    attr_reader :config, :gatekeeper
+
+    def run
+      Logger.info(self, "Starting server", host: config.host, port: config.port)
+
+      endpoint = IO::Endpoint.tcp(config.host, config.port)
+
+      Async do |task|
+        endpoint.bind do |server|
+          loop do
+            socket, address = server.accept
+
+            task.async do
+              handle_connection(socket, address)
+            end
+          end
+        end
+      end
+    end
+
+    def handle_auth(method, *args)
+      handler = self.class.auth_handlers[method]
+      return Auth.reject unless handler
+
+      handler.call(*args)
+    end
+
+    def auth_methods
+      self.class.auth_handlers.keys
+    end
+
+    def banner
+      self.class.read_banner
+    end
+
+    def accepts_channel?(type)
+      case type
+      when :session
+        has_handler?(:shell) || has_handler?(:exec) || has_handler?(:subsystem)
+      when :direct_tcpip
+        has_handler?(:direct_tcpip)
+      when :forwarded_tcpip
+        has_handler?(:forwarded_tcpip)
+      when :x11
+        has_handler?(:x11)
+      else
+        false
+      end
+    end
+
+    def open_channel?(type, channel, ...)
+      method_name = :"open_#{type}?"
+
+      return true unless respond_to?(method_name)
+
+      send(method_name, channel, ...)
+    end
+
+    def accepts_request?(type, channel, **params)
+      rule = self.class.request_rules[type]
+
+      return type == :pty if rule.nil?
+
+      rule.allowed?(channel, **params)
+    end
+
+    def dispatch_handler(type, channel, session, *args)
+      handler_class_or_proc = self.class.handlers[type]
+      return false unless handler_class_or_proc
+
+      case handler_class_or_proc
+      when Class
+        handler = handler_class_or_proc.new(channel, session, *args)
+        handler.call
+      when Proc, Method
+        handler_class_or_proc.call(channel, session, *args)
+      end
+
+      true
+    end
+
+    def has_handler?(type)
+      self.class.handlers.key?(type)
+    end
+
+    private
+
+    def handle_connection(socket, address)
+      peer = format_address(address)
+
+      Logger.info(self, "New connection", peer:)
+
+      if @gatekeeper.block?
+        Logger.warn(self, "Connection rejected, limit reached", peer: peer, **@gatekeeper.stats)
+        socket.close
+        return
+      end
+
+      socket.setsockopt(Socket::IPPROTO_TCP, Socket::TCP_NODELAY, 1) if config.nodelay?
+
+      session = Session.new(socket, server: self)
+      session.start
+
+      Logger.info(self, "connection closed", peer:)
+    rescue => e
+      Logger.error(self, "Connection error", error: e.message)
+    ensure
+      @gatekeeper.disconnect!(was_authenticated: !session&.user.nil?)
+      begin
+        socket.close unless socket.closed?
+      rescue
+        nil
+      end
+    end
+
+    def format_address(address)
+      case address
+      when Addrinfo
+        "#{address.ip_address}:#{address.ip_port}"
+      else
+        address.to_s
+      end
+    end
+  end
+end

data/lib/crussh/ssh_id.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Crussh
+  class SshId
+    PROTO_VERSION = "2.0"
+
+    def initialize(software_version, comments: nil)
+      @software_version = software_version
+      @comments = comments
+    end
+
+    class << self
+      def parse(line)
+        line = line.chomp
+        raise ProtocolError, "Invalid SSH identification: #{line.inspect}" unless line.start_with?("SSH-")
+
+        parts = line.split("-", 3)
+        raise ProtocolError, "Invalid SSH identification" if parts.length < 3
+
+        proto_version = parts[1]
+        unless proto_version == "2.0" || proto_version.start_with?("2.")
+          raise ProtocolError, "Unsupported SSH protocol version: #{proto_version}"
+        end
+
+        software_and_comments = parts[2]
+        software_version, comments = software_and_comments.split(" ", 2)
+
+        new(software_version, comments: comments)
+      end
+    end
+
+    attr_reader :software_version, :comments
+
+    def to_s
+      base = "SSH-#{PROTO_VERSION}-#{@software_version}"
+      base += " #{@comments}" if @comments
+      base
+    end
+
+    def serialize
+      "#{self}\r\n"
+    end
+  end
+end

data/lib/crussh/transport/packet_stream.rb

@@ -0,0 +1,245 @@
+# frozen_string_literal: true
+
+require "io/stream"
+
+module Crussh
+  module Transport
+    class PacketStream
+      MIN_PADDING = 4
+      MAX_PADDING = 255
+      MIN_PACKET_SIZE = 5
+
+      BLOCK_SIZE = 8
+
+      def initialize(socket, max_packet_size:)
+        @stream = IO::Stream(socket)
+        @reader = Reader.new(@stream, max_packet_size)
+        @writer = Writer.new(@stream)
+      end
+
+      def read = @reader.read
+      def write(...) = @writer.write(...)
+
+      def enable_encryption(opening_key, sealing_key)
+        @reader.enable_encryption(opening_key)
+        @writer.enable_encryption(sealing_key)
+      end
+
+      def enable_compression(read_compressor, write_compressor)
+        @reader.enable_compression(read_compressor)
+        @writer.enable_compression(write_compressor)
+      end
+
+      def last_read_sequence = @reader.last_sequence
+      def sequence_wrapped? = @reader.sequence_wrapped?
+
+      def reset_sequence
+        @reader.reset_sequence
+        @writer.reset_sequence
+      end
+
+      class Writer
+        def initialize(stream)
+          @stream = stream
+          @sequence = 0
+          @sealing_key = nil
+
+          @compressor = Compression::None.new
+        end
+
+        def encrypted?
+          !@sealing_key.nil?
+        end
+
+        def write(data)
+          data = @compressor.deflate(data)
+
+          if encrypted?
+            write_encrypted(data)
+          else
+            write_unencrypted(data)
+          end
+
+          @stream.flush
+          increment_sequence
+        end
+
+        def enable_encryption(sealing_key)
+          @sealing_key = sealing_key
+        end
+
+        def enable_compression(compressor)
+          @compressor = compressor
+        end
+
+        def reset_sequence
+          @sequence = 0
+        end
+
+        private
+
+        def increment_sequence
+          @sequence = (@sequence + 1) & 0xFFFFFFFF
+        end
+
+        def write_encrypted(data)
+          padded = pad(data)
+
+          length_bytes = [padded.bytesize].pack("N")
+          encrypted_length = @sealing_key.encrypt_length(@sequence, length_bytes)
+
+          ciphertext, tag = @sealing_key.seal(@sequence, encrypted_length, padded)
+
+          @stream.write(encrypted_length + ciphertext + tag)
+        end
+
+        def write_unencrypted(data)
+          padded = pad(data)
+          packet = [padded.bytesize].pack("N") + padded
+
+          @stream.write(packet)
+        end
+
+        def pad(data)
+          data = data.b
+          payload_length = data.bytesize
+
+          min_total = 1 + payload_length + MIN_PADDING
+          min_total += 4 unless encrypted?
+
+          extra = (BLOCK_SIZE - (min_total % BLOCK_SIZE)) % BLOCK_SIZE
+          padding_length = MIN_PADDING + extra
+
+          padding_bytes = SecureRandom.random_bytes(padding_length)
+
+          [padding_length].pack("C") + data + padding_bytes
+        end
+      end
+
+      class Reader
+        def initialize(stream, max_packet_size)
+          @stream = stream
+          @max_packet_size = max_packet_size
+
+          @sequence = 0
+          @last_sequence = 0
+          @wrapped = false
+
+          @compressor = Compression::None.new
+        end
+
+        attr_reader :last_sequence
+
+        def encrypted?
+          !@opening_key.nil?
+        end
+
+        def read
+          @last_sequence = @sequence
+
+          result = if encrypted?
+            read_encrypted
+          else
+            read_unencrypted
+          end
+
+          increment_sequence
+
+          @compressor.inflate(result)
+        end
+
+        def enable_encryption(opening_key)
+          @opening_key = opening_key
+        end
+
+        def enable_compression(compressor)
+          @compressor = compressor
+        end
+
+        def reset_sequence
+          @sequence = 0
+          @last_sequence = 0
+          @wrapped = false
+        end
+
+        def sequence_wrapped? = @wrapped
+
+        private
+
+        def increment_sequence
+          @wrapped = true if @sequence == 0xFFFFFFFF
+          @sequence = (@sequence + 1) & 0xFFFFFFFF
+        end
+
+        def read_unencrypted
+          length_bytes = @stream.read_exactly(4)
+          packet_length = length_bytes.unpack1("N")
+
+          validate_packet_length!(packet_length)
+
+          data = @stream.read_exactly(packet_length)
+
+          unwrap(data)
+        end
+
+        def read_encrypted
+          encrypted_length = @stream.read_exactly(4)
+
+          length_bytes = @opening_key.decrypt_length(@sequence, encrypted_length)
+          packet_length = length_bytes.unpack1("N")
+
+          validate_packet_length!(packet_length)
+
+          ciphertext = @stream.read_exactly(packet_length)
+          tag = @stream.read_exactly(16)
+
+          plaintext = @opening_key.open(@sequence, encrypted_length, ciphertext, tag)
+
+          unwrap(plaintext)
+        end
+
+        def unwrap(data)
+          return if data.empty?
+
+          padding_length = data.getbyte(0)
+
+          validate_padding_length!(padding_length, data.bytesize)
+
+          payload_length = data.bytesize - padding_length - 1
+
+          validate_payload_length!(payload_length)
+
+          data.byteslice(1, payload_length)
+        end
+
+        def validate_packet_length!(packet_length)
+          if packet_length < MIN_PACKET_SIZE
+            raise PacketTooSmall, "Packet length #{packet_length} below minimum #{MIN_PACKET_SIZE}"
+          end
+
+          return if packet_length <= @max_packet_size
+
+          raise PacketTooLarge, "Packet length #{packet_length} exceeds maximum #{@max_packet_size}"
+        end
+
+        def validate_padding_length!(padding_length, packet_length)
+          if padding_length < MIN_PADDING
+            raise InvalidPadding, "Padding length #{padding_length} below minimum #{MIN_PADDING}"
+          end
+
+          if padding_length > MAX_PADDING
+            raise InvalidPadding, "Padding length #{padding_length} exceeds maximum #{MAX_PADDING}"
+          end
+
+          return if padding_length < packet_length
+
+          raise InvalidPadding, "Padding length #{padding_length} >= packet length #{packet_length}"
+        end
+
+        def validate_payload_length!(payload_length)
+          raise PacketTooSmall, "Invalid payload length: #{payload_length}" if payload_length.negative?
+        end
+      end
+    end
+  end
+end

data/lib/crussh/transport/reader.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+module Crussh
+  module Transport
+    class Reader
+      def initialize(data)
+        @data = data.b
+        @position = 0
+      end
+
+      def byte
+        ensure_remaining!(1)
+
+        value = @data.getbyte(@position)
+
+        @position += 1
+
+        value
+      end
+
+      def boolean
+        byte != 0
+      end
+
+      def uint32
+        ensure_remaining!(4)
+
+        value = @data[@position, 4].unpack1("N")
+
+        @position += 4
+
+        value
+      end
+
+      def string(max_length: nil)
+        length = uint32
+
+        raise PacketTooLarge, "String length #{length} exceeds maximum #{max_length}" if max_length && length > max_length
+
+        ensure_remaining!(length)
+
+        value = @data[@position, length]
+
+        @position += length
+
+        value
+      end
+
+      def read(n)
+        ensure_remaining!(n)
+
+        value = @data[@position, n]
+
+        @position += n
+
+        value
+      end
+
+      def mpint
+        raw = string
+
+        return OpenSSL::BN.new(0) if raw.empty?
+
+        OpenSSL::BN.new(raw, 2)
+      end
+
+      def name_list
+        string.split(",")
+      end
+
+      def remaining
+        @data.byteslice(@position..)
+      end
+
+      def remaining_bytes
+        @data.bytesize - @position
+      end
+
+      def skip(n)
+        ensure_remaining!(n)
+
+        @position += n
+      end
+
+      def eof?
+        @position >= @data.bytesize
+      end
+
+      private
+
+      def ensure_remaining!(n)
+        return if @position + n <= @data.bytesize
+
+        raise IncompletePacket, "Need #{n} bytes but only #{remaining_bytes} available"
+      end
+    end
+  end
+end

data/lib/crussh/transport/version_exchange.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Crussh
+  module Transport
+    class VersionExchange
+      MAX_VERSION_LENGTH = 255
+
+      def initialize(socket, server_id:)
+        @socket = socket
+        @server_id = server_id
+      end
+
+      def exchange
+        @socket.write(@server_id.serialize)
+
+        loop do
+          line = @socket.readline(MAX_VERSION_LENGTH, chomp: true)
+
+          next unless line.start_with?("SSH-")
+
+          return SshId.parse(line)
+        end
+      end
+    end
+  end
+end

data/lib/crussh/transport/writer.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module Crussh
+  module Transport
+    class Writer
+      def initialize
+        @buffer = String.new(encoding: Encoding::BINARY, capacity: 256)
+      end
+
+      def byte(value)
+        @buffer << [value].pack("C")
+        self
+      end
+
+      def boolean(value)
+        byte(value ? 1 : 0)
+      end
+
+      def uint32(value)
+        @buffer << [value].pack("N")
+        self
+      end
+
+      def string(value)
+        value = value.b if value.is_a?(String)
+        uint32(value.bytesize)
+        @buffer << value
+        self
+      end
+
+      def name_list(names)
+        string(names.join(","))
+      end
+
+      def raw(bytes)
+        @buffer << bytes
+        self
+      end
+
+      def remaining(value)
+        raw(value.b)
+        self
+      end
+
+      def mpint(bn)
+        bn = OpenSSL::BN.new(bn) if bn.is_a?(Integer)
+
+        return uint32(0) if bn.zero?
+
+        raw_bytes = bn.to_s(2)
+
+        # two's compliment moment
+        raw_bytes = "\u0000#{raw_bytes}" if raw_bytes.getbyte(0) & 0x80 != 0
+
+        string(raw_bytes)
+      end
+
+      def to_s
+        @buffer.dup
+      end
+
+      def length
+        @buffer.bytesize
+      end
+
+      def reset
+        @buffer.clear
+        self
+      end
+    end
+  end
+end

data/lib/crussh/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Crussh
+  VERSION = "0.1.0"
+end